Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
Articles on breach notification timelines, minimum necessary standards, and Security Rule requirements that healthcare IT teams need to understand. From encryption decisions to access logging, these resources help organizations implement technical safeguards that satisfy both the letter and spirit of HIPAA.
15 min read
New Jersey gives HIPAA-covered practices no pass on its breach statute, and it puts the State Police first in line. Here is how the state and federal layers fit together.
8 min read
Signal has strong end-to-end encryption. It still offers no BAA, no access logs for a practice, and no records to hand over. Encryption was never the whole question.
10 min read
Square has a real BAA, folded into its terms. It also has a list of things the BAA does not touch, and most practices have never read either one.
9 min read
A patient list is PHI before you type a single word of the newsletter. Mailchimp has no BAA and tells you, in its own contract, not to send that list.
11 min read
DocuSign will sign a BAA, but only on the right plan. You also have to set up the account so signed patient data does not leak through email, retention settings, or a shared login. Here is which plans qualify and what to set.
9 min read
Yes, HIPAA requires a sanction policy. You must apply appropriate discipline to workforce members who violate your rules, document what you did, and keep the record for six years. Here is what a real one looks like and the mistakes that get practices cited.
6 min read
Urgent care runs at a pace HIPAA never slows down for. The four pressure points: the walk-in desk, the shared workstation, the rotating roster, and the employer on line two.
6 min read
An optometry practice is a clinic and a retail store sharing one computer system. That split is exactly where its HIPAA problems live, and where the fixes are.
5 min read
Does a cash chiropractic practice need HIPAA? The answer comes down to one test. If you send even one electronic claim or eligibility check, HIPAA applies to you. Here is how to run the test, plus the rules for testimonials, attorney faxes, and X-rays.
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Walk through your current program with an experienced compliance consultant. Get an honest assessment and a clearer path forward.